Amendments to the claims 



Please amend the claims as indicated below. Added text is 
underlined and deleted text is either struck through or enclosed in double 
brackets. No new matter is being added. 

1. (Currently amended) In a network, a method of processing received e- 
mail messages comprising: 

a) identifying information about a sender of a received e- 
mail message based on data in the message, the identified information 
about the sender including at least one of the following: 

i) an actual sender of the message; 

ii) a final IP address used by the sender; 

hi) a final domain name used by the sender; or 
iv) an IP path used by the sender; 

b) categorizing whether the received message is 
unsolicited e-mail by using statistics based on the identified information 
about the sender; and 

c) processing the received message based on its 
categorization. 
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2. (Original) The method of claim 1 wherein the actual sender is 
identified by a signature that includes at least two of the following fields 
from the message header: 



a) 


an e-mail address used by the sender; 


b) 


a display name used by the sender; 


c) 


a domain name used by the sender; 


d) 


the final IP address used by the sender; 


e) 


the final domain name used by the sender; 


f) 


the name of client software used by the actual sender; 


g) 


user-agent; 


h) 


time zone; 


i) 


source IP address; 


j) 


sendmail version used by a first receiver; and 


k) 


the IP path used to route the message. 



3. (Original) The method of claim 1 wherein the actual sender is 
identified by a signature including a range of IP addresses and at least 
one of the following fields from the message header: 



a) 


an e-mail address used by the sender; 


b) 


a display name used by the sender; 


c) 


a domain name used by the sender; 


d) 


the final IP address used by the sender; 


e) 


the final domain name used by the sender; 


f) 


the name of client software used by the actual sender; 


g) 


user-agent; 


h) 


time zone; 


i) 


source IP address; 


j) 


sendmail version used by a first receiver; and 


k) 


the IP path used to route the message. 
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4. (Currently amended) The method of claim 1 further comprising using 
statistics compiled in at least one database to categorize whether the 
received message is unsolicited e-mail, wherein the at least one database 
includes one of the following: 

a) a central database; 

b) at least two centrally-maintained databases, each 
storing and compiling different information and statistics; and 

c) a local database. 

5. (Original) The method of claim 4 further comprising using statistics 
compiled at the at least one database to compute a score indicating a 
likelihood that the received message is unsolicited e-maiL 

6. (Original) The method of claim 5 wherein the score increases as a 
number of accepted messages having the same information about the 
sender as the received message increases, the information including one of 
the following: 

a) an actual sender; 

b) a final IP address used by the sender; 

c) a final domain name used by the sender; or 

d) an IP path used by the sender. 

7. (Original) The method of claim 5 wherein the score decreases as a 
number of rejected messages having the same information about the 
sender as the received message increases, the information including one of 
the following: 

a) an actual sender; 

b) a final IP address used by the sender; 

c) a final domain name used by the sender; or 

d) an IP path used by the sender. 
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8. (Original) The method of claim 5 wherein the score increases as a 
number of unique users in the network accepting messages having the 
same information about the sender as the received message increases, the 
information including one of the following: 

a) an actual sender; 

b) a final IP address used by the sender; 

c) a final domain name used by the sender; or 

d) an IP path used by the sender. 

9. (Original) The method of claim 5 wherein the score decreases as a 
number of unique users in the network rejecting messages having the 
same information about the sender as the received message increases, the 
information including one of the following: 

a) an actual sender; 

b) a final IP address used by the sender; 

c) a final domain name used by the sender; or 

d) an IP path used by the sender. 

10. (Original) The method of claim 1 further comprising determining the 
final IP address used by the sender by identifying an IP address of a first 
network device used to send the e-mail message to a second network 
device trusted by a recipient of the message. 

11. (Original) The method of claim 1 further comprising determining the 
final domain name used by the sender by identifying a domain name of an 
IP address of a first network device used to send the e-mail message to a 
second network device trusted by a recipient of the message. 
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1 12. (Original) The method of claim 11 further comprising determining 

2 the final domain name used by the sender by removing a predetermined 

3 number of subdomains from the domain name of the IP address of the first 

4 network device used to send the e-mail message to the second network 

5 device trusted by the recipient of the message. 

1 13. (Original) The method of claim 1 further comprising creating a 

2 whitelist indicating which messages will be accepted by a recipient, the 

3 accepted messages identified by at least one of the following: 

4 a) an e-mail address; 

5 b) an actual sender; 

6 c) a display name; 

7 d) a domain name; 

8 e) a final domain name; 

9 f) a final IP address; and 
10 g) an IP path. 

1 14. (Original) The method of claim 13 further comprising placing the 

2 message in the recipient's inbox if the whitelist indicates the recipient will 

3 accept the message. 
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15. (Original) The method of claim 1 further comprising creating a 
blacklist which indicates which messages will not be accepted by a 
recipient, the unaccepted messages identified by at least one of the 
following: 

a) an e-mail address; 

b) an actual sender; 

c) a display name; 

d) a domain name; 

e) a final domain name; 

f) a final IP address; 

g) an IP path. 

16. (Original) The method of claim 15 further comprising disposing of the 
message if the blacklist indicates the recipient will not accept the 
message, the disposal of the message including one of the following: 

a) placing the message in a spam folder; or 

b) deleting the message. 
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1 17. (Original) The method of claim 4 further comprising sending 

2 information about received messages to the at least one database, the 

3 information including at least two of the following: 

4 a) information identifying the actual sender; 

5 b) whether the actual sender is included on a recipient's 

6 whitelist; 

7 c) whether the actual sender is included on the 

8 recipient's blacklist; 

9 d) information identifying the final IP address; 
io e) whether the final IP address is included on the 
n recipient's whitelist; 

12 f) whether the final IP address is included on the 

13 recipient's blacklist; 

14 g) information identifying the final domain name; 

15 h) whether the final domain name is included on the 

16 recipient's whitelist; 

17 i) whether the final domain name is included on the 

18 recipient's blacklist; 

19 j) information identifying the IP path; 

20 k) whether the IP path is included on the recipient's 

2 1 whitelist; 

22 1) whether the IP path is included on the recipient's 

23 blacklist; 

24 m) whether the message could be categorized locally; and 

25 n) whether a recipient changed a white list/blacklist 
2 6 status of the message. 

1 18. (Original) The method of claim 17 further comprising storing 

2 information about received messages at the at least one database. 
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19. (Original) The method of claim 4 further comprising requesting the at 
least one database to send a recipient statistics about at least one of the 
following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; and 

d) an IP path. 

20. (Original) The method of claim 4 further comprising sending the 
recipient statistics about at least one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; and 

d) an IP path. 
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1 21. (Original) The method of claim 18 further comprising storing 

2 information, about messages sent from an actual sender including at least 

3 one of the following: 

4 a) a total number of messages sent; 

5 b) a number of messages sent over a first predetermined 

6 time period; 

7 c) a total number of messages sent to recipients in a 

8 network who have included the actual sender on a whitelist; 

9 d) a number of messages sent to recipients in the network 

10 who have included the actual sender on the whitelist over a second 

11 predetermined time period; 

12 e) a number of recipients who have included the actual 

13 sender on the whitelist; 

14 f) a total number of times a recipient changed the actual 
is sender's white list/blacklist status; 

16 g) a number of times a recipient changed the actual 

17 sender's whitelist/blacklist status over a third predetermined time period; 

18 h) a total number of messages sent to recipients in the 

19 network who have not included the actual sender on the whitelist; 

20 i) a number of messages sent to recipients in the network 

21 who have not included the actual sender on the whitelist over a fourth 

22 predetermined time period; 

23 j) a total number of unique recipients in the network who 

24 have received at least one message from the actual sender; 

25 k) a total number of messages sent to unique recipients in 
2 6 a network who have included the actual sender on a whitelist; and 

27 1) a total number of messages sent to unique recipients in 

2 8 the network who have not included the actual sender on the whitelist. 
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1 22. (Original) The method of claim 18 further comprising storing 

2 information about messages sent from a final IP address including at least 

3 one of the following: 

4 a) a total number of messages sent; 

5 b) a number of messages sent over a first predetermined 

6 time period; 

7 c) a total number of messages sent to recipients in the 

8 network who have included the sender on a whitelist; 

9 d) a number of messages sent to recipients in the network 
10 who have included the sender on the whitelist over a second 

n predetermined time period; 

12 e) a number of recipients who have whitelisted senders 

13 having the final IP address who know the sender; 

14 f) a total number of times a recipient changed a 
is whitelist/blacklist status of any sender using the final IP address; 

16 g) a number of times a recipient changed the 

17 whitelist/blacklist status of any sender using the final IP address over a 

18 third predetermined time period; 

19 h) a total number of messages sent to recipients in the 

20 network who have not included the sender on the whitelist; 

21 i) a number of messages sent to recipients in the network 

22 who have not included the sender on the whitelist over a fourth 

23 predetermined time period; 

24 j) a total number of unique recipients in the network who 

25 have received at least one message from at least one sender using the final 
2 6 IP address; 

2 7 k) a total number of messages sent to unique recipients in 

2 8 the network who have included the sender on the whitelist; and 

29 1) a total number of messages sent to unique recipients in 

30 the network who have not included the sender on the whitelist. 
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1 23. (Original) The method of claim 18 further comprising storing 

2 information about messages sent from a final domain name including at 

3 least one of the following: 

4 a) a total number of messages sent; 

5 b) a number of messages sent over a first predetermined 

6 time period; 

7 c) a total number of messages sent to recipients in the 

8 network who have included the sender on a whitelist; 

9 d) a number of messages sent to recipients in the network 
10 who have included the sender on the whitelist over a second 

n predetermined time period; 

12 e) a number of recipients who have included senders 

13 having the final domain name on the whitelist; 

14 f) a total number of times a recipient changed a 

is whitelist/blacklist status of any sender using the final domain name; 

16 g) a number of times a recipient changed the 

17 whitelist/blacklist status of any sender using the final domain name over 

18 a third predetermined time period; 

19 h) a total number of messages sent to recipients in the 

20 network who have not included the sender on the whitelist; 

21 i) a number of messages sent to recipients in the network 

22 who have not included the sender on the whitelist over a fourth 

23 predetermined time period; 

24 j) a total number of unique recipients in the network who 

25 have received at least one message from at least one sender using the final 
2 6 domain name ; 

27 k) a total number of messages sent to unique recipients in 

2 8 the network who have included the sender on the whitelist; and 

29 1) a total number of messages sent to unique recipients in 

3 0 the network who have not included the sender on the whitelist. 
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1 24. (Original) The method of claim 18 further comprising storing 

2 information about messages sent using an IP path including at least one 

3 of the following: 

4 a) a total number of messages sent; 

5 b) a number of messages sent over a first predetermined 

6 time period; 

7 c) a total number of messages sent to recipients in the 

8 network who have included the sender on a whitelist; 

9 d) a number of messages sent to recipients in the network 
10 who have included the sender on the whitelist over a second 

n predetermined time period; 

12 e) a number of recipients who know senders using the IP 

13 path; 

14 f) a total number of times a recipient changed a 
is whitelist/blacklist status of any sender using the IP path; 

16 g) a number of times a recipient changed the 

17 whitelist/blacklist status of any sender using the IP path over a third 
is predetermined time period; 

19 h) a total number of messages sent to recipients in the 

20 network who have not included the sender on the whitelist; 

21 i) a number of messages sent to recipients in the network 

22 who have not included the sender on the whitelist in the network over a 

23 fourth predetermined time period; 

24 j) a total number of unique recipients in the network who 

25 have received at least one message from at least one sender using the IP 

26 path; 

27 k) a total number of messages sent to unique recipients in 
2 8 the network who have included the sender on the whitelist; and 

29 1) a total number of messages sent to unique recipients in 

30 the network who have not included the sender on the whitelist. 
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1 25. (Original) The method of claim 4 wherein compiling statistics 

2 includes at least one of the following: 

3 a) determining a ratio of a first number 

4 e-mail messages sent by an actual sender to recipients in the network who 

5 have included the sender on the whitelist in a predetermined time period 

6 divided by a second number of e-mail messages sent by an actual sender to 

7 users in the network in the predetermined time period; 

8 b) determining a ratio of a first number of recipients in 

9 the network who have included the sender on the whitelist divided by a 

10 second number of unique recipients in the network who received e-mails 

11 from the actual sender in a predetermined time period; 

12 c) determining a ratio of a first number of times in a 

13 predetermined time interval a message from the actual sender was moved 

14 from a whitelist to a blacklist divided by a second number of times a 

15 message from the actual sender was moved from a whitelist to a blacklist; 

16 d) determining a ratio of a first number of times in a 

17 predetermined time interval a message from the actual sender was moved 

18 from a blacklist to a whitelist divided by a second number of times a 

19 message from the actual sender was moved from a blacklist to a whitelist; 

20 e) determining a ratio of a first number of unique users 

21 within the network who white listed the actual sender within a 

22 predetermined time period compared to a second number of unique users 

23 within the network who blacklisted the actual sender within the 

24 predetermined time period; 

2 5 f) determining a ratio reflecting whether the actual 

26 sender sends a majority of messages to recipients who have included the 

2 7 actual sender on the whitelist; 

2 8 g) determining a ratio reflecting a first number of wanted 

29 messages sent by the actual sender compared to a second number of 

30 unwanted or total messages sent by the actual sender; 
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31 h) determining a difference between a first number of 

32 expected messages sent by the actual sender and a second number of 

33 unexpected messages sent by the actual sender; 

34 i) determining a difference between a first number of 

35 times a user whitelisted a message from the actual sender and a second 

36 number of times a user blacklisted a message from the actual sender; 

37 j) determining a difference reflecting whether the actual 
3 8 sender sends a majority of messages to known recipients; 

39 k) converting any of the above ratios or differences or 

40 differences to a score indicating the likelihood the message is unsolicited 

41 e-mail; and 

42 1) applying the score to the appropriate message in the 

43 spam folder. 
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1 26. (Original) The method of claim 4 wherein compiling statistics 

2 includes at least one of the following: 

3 a) determining a ratio of a first number e-mail messages 

4 sent by any sender using a final IP address to recipients in the network 

5 who have included the sender on the whitelist in a predetermined time 

6 period divided by a second number of e-mail messages sent by an any 

7 sender using the final IP address to users in the network in the 

8 predetermined time period; 

9 b) determining a ratio of a first number of recipients in 
10 the network who have included the sender on the whitelist divided by a 
n second number of unique recipients in the network who received e-mails 

12 from any sender using the final IP address in a predetermined time 

13 period; 

14 c) determining a ratio of a first number of times in a 

15 predetermined time interval a message from any sender using the final IP 

16 address was moved from a whitelist to a blacklist divided by a second 

17 number of times a message from any sender using the final IP address 

18 was moved from a whitelist to a blacklist; 

19 d) determining a ratio of a first number of times in a 

20 predetermined time interval a message from any sender using the final IP 

21 address was moved from a blacklist to a whitelist divided by a second 

22 number of times a message from any sender using the final IP address 

23 was moved from a blacklist to a whitelist; 

24 e) determining a ratio of a first number of unique users 

2 5 within the network who whitelisted any sender using the final IP address 

2 6 within a predetermined time period compared to a second number of 

27 unique users within the network who blacklisted any sender using the 

2 8 final IP address within the predetermined time period; 

2 9 f) determining a ratio reflecting whether any sender 

3 0 using the final IP address sends a majority of messages to recipients who 
3i have included the sender on the whitelist; 
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32 g) determining a ratio reflecting a first number of wanted 

33 messages sent by any sender using the final IP address compared to a 

34 second number of unwanted or total messages sent by any sender using 
3 5 the final IP address; 

3 6 h) determining a difference between a first number of 

37 expected messages sent by any sender using the final IP address and a 

3 8 second number of unexpected messages sent by any sender using the final 

3 9 IP address; 

4 0 i) determining a difference between a first number of 
4i times a user white listed a message from any sender using the final IP 

4 2 address and a second number of times a user blacklisted a message from 

43 any sender using the final IP address; 

44 j) determining a difference reflecting whether any sender 

45 using the final IP address sends a majority of messages to recipients who 
4 6 have included the sender on the whitelist; 

4 7 k) converting any of the above ratios or differences or 

4 8 differences to a score indicating the likelihood the message is unsolicited 

49 e-mail; and 

so 1) applying the score to the appropriate message in the 

si spam folder. 
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1 27. (Original) The method of claim 4 wherein compiling statistics 

2 includes at least one of the following: 

3 a) determining a ratio of a first number 

4 e-mail messages sent by any sender using a final domain name to 

5 recipients in the network who have included the sender on the whitelist in 

6 a predetermined time period divided by a second number of e-mail 

7 messages sent by any sender using the final domain name to users in the 

8 network in the predetermined time period; 

9 b) determining a ratio of a first number of recipients in 
10 the network who have included the sender on the whitelist divided by a 
n second number of unique recipients in the network who received e-mails 

12 from any sender using the final domain name in a predetermined time 

13 period; 

14 c) determining a ratio of a first number of times in a 

15 predetermined time interval a message from any sender using the final 

16 domain name was moved from a whitelist to a blacklist divided by a 

17 second number of times a message from any sender using the final domain 

18 name was moved from a whitelist to a blacklist; 

19 d) determining a ratio of a first number of times in a 

20 predetermined time interval a message from any sender using the final 

21 domain name was moved from a blacklist to a whitelist divided by a 

22 second number of times a message from any sender using the final domain 
2 3 name was moved from a blacklist to a whitelist; 

24 e) determining a ratio of a first number of unique users 

25 within the network who whitelisted any sender using the final domain 

2 6 name within a predetermined time period compared to a second number of 

2 7 unique users within the network who blacklisted any sender using the 

2 8 final domain name within the predetermined time period; 

2 9 f) determining a ratio reflecting whether any sender 

3 0 using the final domain name sends a majority of messages to recipients 
31 who have included the sender on the whitelist; 
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32 g) determining a ratio reflecting a first number of wanted 

33 messages sent by any sender using the final domain name compared to a 

34 second number of unwanted or total messages sent by any sender using 

35 the final domain name; 

3 6 h) determining a difference between a first number of 

37 expected messages sent by any sender using the final domain name and a 

3 8 second number of expected messages sent by any sender using the final 

3 9 dom ain name ; 

4 0 i) determining a difference between a first number of 
41 times a user whitelisted a message from any sender using the final 

4 2 domain name and a second number of times a user blacklisted a message 

43 from any sender using the final domain name; 

44 j) determining a difference reflecting whether any sender 

45 using the final domain name sends a majority of messages to recipients 
4 6 who have included the sender on the whitelist; 

4 7 k) converting any of the above ratios or differences or 

4 8 differences to a score indicating the likelihood the message is unsolicited 

49 e-mail; and 

so 1) applying the score to the appropriate message in the 

si spam folder. 
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1 28. (Original) The method of claim 4 wherein compiling statistics 

2 includes at least one of the following: 

3 a) determining a ratio of a first number e-mail messages 

4 sent by any sender using an IP path to recipients in the network who have 

5 included the sender on the whitelist in a predetermined time period 

6 divided by a second number of e-mail messages sent by any sender using 

7 the IP path to users in the network in the predetermined time period; 

8 b) determining a ratio of a first number of recipients in 

9 the network who have included the sender on the whitelist divided by a 
10 second number of unique recipients in the network who received e-mails 
n from any sender using the IP path in a predetermined time period; 

12 c) determining a ratio of a first number of times in a 

13 predetermined time interval a message from any sender using the IP path 

14 was moved from a whitelist to a blacklist divided by a second number of 
is times a message from any sender using the IP path was moved from a 

16 whitelist to a blacklist; 

17 d) determining a ratio of a first number of times in a 

18 predetermined time interval a message from any sender using the IP path 

19 was moved from a blacklist to a whitelist divided by a second number of 

20 times a message from any sender using the IP path was moved from a 

2 1 blacklist to a whitelist; 

22 e) determining a ratio of a first number of unique users 

2 3 within the network who whitelisted any sender using the IP path within a 

24 predetermined time period compared to a second number of unique users 

2 5 within the network who blacklisted any sender using the IP path within 

2 6 the predetermined time period; 

2 7 f) determining a ratio reflecting whether any sender 

2 8 using the IP path sends a majority of messages to recipients who have 

2 9 included the sender on the whitelist; 
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30 g) determining a ratio reflecting a first number of wanted 

31 messages sent by any sender using the IP path compared to a second 

32 number of unwanted or total messages sent by any sender using the IP 

33 path; 

34 h) determining a difference between a first number of 

35 expected messages sent by any sender using the IP path and a second 
3 6 number of unexpected messages sent by any user using the IP path; 
37 i) determining a difference between a first number of 

3 8 times a user whitelisted a message from any sender using the IP path and 

39 a second number of times a user blacklisted a message from any sender 

40 using the IP path; 

41 j) determining a difference reflecting whether any sender 

42 using the IP path sends a majority of messages to recipients who have 

43 included the sender on the whitelist; 

44 k) converting any of the above ratios or differences or 

45 differences to a score indicating the likelihood the message is unsolicited 

4 6 e-mail; and 

4 7 1) applying the score to the appropriate message in the 

4 8 spam folder. 

1 29. (Original) The method of claim 4 further comprising setting a 

2 predetermined threshold for accepting messages based on statistics 

3 associated with one of the following: 

4 a) an actual sender; 

5 b) a final IP address; 

6 c) a final domain name; and 

7 d) an IP path. 

1 30. (Original) The method of claim 29 further comprising accepting 

2 messages when information about the message exceeds the predetermined 

3 threshold. 
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1 31. (Original) The method of claim 30 further comprising setting a low 

2 threshold to differentiate wanted messages from unsolicited messages, 

3 wherein the low threshold is either: 

4 a) greater than one percent of a number of messages sent 

5 are accepted, wherein the messages are characterized by one of the 

6 following: 

7 i) an actual sender; 

8 ii) a final IP address; 

9 iii) a final domain name; or 
10 iv) an IP path; 

n b) greater than one percent of a number of unique users 

12 accepting a message wherein the message is characterized by one of the 

13 following: 

14 i) an actual sender; 

15 ii) a final IP address; 

16 iii) a final domain name; or 

17 iv) an IP path. 

1 32. (Original) The method of claim 4 further comprising revising 

2 statistics when a recipient changes a whitelist/blacklist status of one of 

3 the following: 

4 a) an actual sender; 

5 b) a final IP address; 

6 c) a final domain name; or 

7 d) an IP path. 

1 33. (Original) The method of claim 17 further comprising creating a key 

2 for storing information about the actual sender. 

1 34. (Original) The method of claim 33 wherein the key is the information 

2 used to identify the actual sender. 
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35. (Original) The method of claim 32 wherein a manual reversal of a 
whitelist/blacklist status of one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path; 

is more heavily weighted when revising statistics. 

36. (Original) The method of claim 1 wherein processing the received 
message includes placing the message in the recipient's inbox. 

37. (Original) The method of claim 1 wherein processing the received 
message includes placing the message in a spam folder. 

38. (Original) The method of claim 37 further comprising monitoring the 
spam folder at predetermined intervals to determine whether messages 
should be released. 

39. (Original) The method of claim 38 further comprising automatically 
releasing the message from the spam folder when the reputation of one of 
the following: 

a) the actual sender; 

b) the final IP address; 

c) the final domain name; or 

d) the IP path; 
passes a predetermined threshold. 

40. (Original) The method of claim 37 further comprising reevaluating 
the spam folder immediately before it is displayed to a recipient such that 
information about messages in the spam folder is current when viewed by 
the recipient. 
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41. (Original) The method of claim 37 further comprising manually 
transferring the message from the spam folder to the recipient's inbox. 

41. (Cancelled) 

42. (Original) The method of claim 29 further comprising each user 
setting a predetermined personalized spam threshold, wherein an 
incoming message that exceeds the spam threshold is sent to a folder 
designated to hold spam messages. 

43. (Original) The method of claim 29 further comprising each user 
setting a predetermined personalized delete threshold, wherein an 
incoming message that exceeds the delete threshold is deleted. 
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44. (Original) The method of claim 4 further comprising maintaining at 
either the central database or the at least two centrally-maintained 
databases at least four of the following values: 

a) a number of messages which were explicitly ranked 



good; 
good; 

bad; and 
bad; 



b) a number of messages which were implicitly ranked 

c) a number of messages whose ranking is unknown; 

d) a number of messages which were explicitly ranked 

e) a number of messages which were implicitly ranked 



wherein the values are based on messages having the same 
information about the sender including one of the following: 

a) an actual sender; 

b) a final IP address used by the sender; 

c) a final domain name used by the sender; or 

d) an IP path used by the sender. 

45. (Original) The method of claim 44 wherein the values represent one 
of the following: 

a) message counts; or 

b) ratings of unique users within the network. 

46. (Original) The method of claim 45 further comprising at least four of 
the values being returned to the recipient to allow the recipient to apply 
different weights to a message in order to categorize the message. 
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47. (Original) The method of claim 4 further comprising evaluating an 
unknown sender based on statistics of one of the following: 

a) a known final IP address used by the sender; or 

b) a known final domain name used by the sender. 

48. (Original) The method of claim 4 further comprising evaluating an 
unknown sender using either a known final IP address or a known final 
domain name based on statistics about other new senders using either the 
known final IP address or the known final domain. 

49. (Original) The method of claim 4 further comprising giving an 
unknown final IP address or final domain name an initial good rating. 

50. (Original) The method of claim 4 further comprising giving an 
unknown final IP address or domain name an initial rating based on the 
length of time the network has been in operation. 

51. (Original) The method of claim 17 further comprising older members 
of the network overwriting a new member's message ratings when the 
new member's ratings are inconsistent when compared to other member's 
ratings. 
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52. (Original) The method of claim 5 wherein a final message score is 
determined by one of the following: 

a) an average of two scores for a message; or 

b) a product of two scores for the message; 

wherein the scores for messages are based on statistics associated with a 
least two of the following: 

a) an actual sender of the message; 

b) a final IP address used by the sender; 

c) a final domain name used by the sender; or 

d) an IP path used by the sender. 

53. (Original) The method of claim 19 wherein personal statistics are 
checked at the local database before global statistics at either the central 
database or the at least two centrally-maintained databases are checked. 

54. (Original) The method of claim 17 further comprising rating a sender 
by: 

a) releasing small numbers of the sender's messages to 
recipients; and 

b) monitoring the recipients' classification of these 
messages to determine the sender's rating. 

55. (Original) The method of claim 17 further comprising changing one 
user's rating when other members outvote the user's rating. 

56. (Original) The method of claim 19 wherein either the central 
database or the at least two centrally-maintained databases return more 
than one value to the recipient. 
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1 57. (Original) The method of claim 36 further comprising monitoring the 

2 inbox at predetermined intervals to determine whether messages should 

3 remain in the inbox. 

1 58. (Original) The method of claim 5 wherein a first score for an 

2 unknown sender using a known final IP address or final domain name 

3 may be obtained by multiplying a second score for the final IP address or 

4 final domain name by a number less than one. 

1 59. (Original) The method of claim 13 further comprising creating the 

2 whitelist by adding the following to the whitelist: 

3 a) any e-mail addresses stored by a user of the e-mail 

4 program; 

5 b) any e-mail address in an outgoing message; and 

6 c) any e-mail address of a sender of a message having the 

7 same subject line as another message previously sent by the user. 

1 60. (Original) The method of claim 59 further comprising combining each 

2 e-mail address added to the whitelist with at least one other piece of 

3 information from the message header including: 



4 


a) 


a display name used by the sender; 


5 


b) 


a domain name used by the sender; 


6 


c) 


the final IP address used by the sender; 


7 


d) 


the final domain name used by the sender; 


8 


e) 


the name of client software used by the actual sender; 


9 


f) 


user-agent; 


10 


g) 


time zone; 


11 


h) 


source IP address; 


12 


i) 


sendmail version used by a first receiver; and 


13 


j) 


the IP path used to route the message. 
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61. (Original) The method of claim 59 further comprising: 

a) scanning messages received by the user; and 

b) determining if a sender of a received message is on the 
whitelist, wherein if the sender is on the whitelist: 

i) identifying information about the sender of the 
message based on data in the message, the identified information about 
the sender including at least one of the following: 

A) an actual sender of the message; 

B) a final IP address used by the sender; 

C) a final domain name used by the sender; 



or 



D) an IP path used by the sender; and 
ii) sending the identified information to the at least 



one database. 



62. (Original) The method of claim 4 further comprising categorizing a 
received message that cannot be rated locally when user activity is 
observed. 



63. (Original) The method of claim 5 further comprising using a second 
formula to compute the score for the message when the message is 
reevaluated, wherein the second formula differs from a first formula used 
to compute the previous message score. 

64. (Original) The method of claim 1 further comprising sending 
recipients a notification when any sender's reputation changes. 

65. (Original) The method of claim 64 further comprising reviewing all 
messages received in a predetermined time period preceding receipt of the 
notification and updating the categorization of the message as necessary. 
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66. (Currently amended) A computer-readable storage medium storing 
instructions that, when executed by a computer, cause the computer to 
perform a method of processing a received e-mail message, the method 
performed by the computer executing the instruction stored on the 
medium comprising: 

a) identifying information about a sender of a received e- 
mail message based on data in the message, the identified information 
about the sender including at least one of the following: 

i) an actual sender of the message; 

ii) a final IP address used by the sender; 

iii) a final domain name used by the sender; or 

iv) an IP path used by the sender; 

b) categorizing whether the received message is 
unsolicited e-mail by using statistics based on the identified information 
about the sender; and 

c) processing the received message based on its 
categorization. 
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1 


67. (Original) ' 


The computer-readable storage medium of claim 66 


2 


wherein the actual sender is identified by a signature that includes at 


3 


least two of the following fields from the message header: 


4 


a) 


an e-mail address used by the sender; 


5 


b) 


a display name used by the sender; 


6 


c) 


a domain name used by the sender; 


7 


d) 


the final IP address used by the sender; 


8 


e) 


the final domain name used by the sender; 


9 


V 


the name of client software used by the actual sender; 


10 


g) 


use r- agent ; 


11 


h) 


time zone; 


12 


i) 


source IP address; 


13 


j) 


sendmail version used by a first receiver; and 


14 


k) 


the IP path used to route the message. 


1 


68. (Original) The computer-readable storage medium of claim 66 


2 


wherein the actual sender is identified by a signature including a range oj 


3 


IP addresses and at least one of the following fields from the message 


4 


header: 




5 


a) 


an e-mail address used by the sender; 


6 


b) 


a display name used by the sender; 


7 


c) 


a domain name used by the sender; 


8 


d) 


the final IP address used by the sender; 


9 


e) 


the final domain name used by the sender; 


10 


f) 


the name of client software used by the actual sendee- 


11 


g) 


user- agent; 


12 


h) 


time zone; 


13 


i) 


source IP address; 


14 


j) 


sendmail version used by a first receiver; and 


15 


k) 


the IP path used to route the message. 



-32- 



A7:ABC-007.AMT 



69. (Original) The computer-readable storage medium of claim 66, the 
method further using statistics compiled at at least one database to 
categorize whether the received message is unsolicited e-mail, wherein the 
at least one database includes one of the following: 

a) a central database; 

b) at least two centrally-maintained databases, each 
storing and compiling different information and statistics; and 

c) a local database. 

70. (Original) The computer-readable storage medium of claim 69, the 
method further comprising using the statistics compiled at at least one 
database to compute a score indicating the likelihood that the received 
message is unsolicited e-mail. 

71. (Original) The computer-readable storage medium of claim 70 
wherein the score increases as a number of accepted messages having the 
same information about the sender as the received message increases, the 
information including one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path. 

72. (Original) The computer-readable storage medium of claim 70 
wherein the score decreases as a number of rejected messages having the 
same information about the sender as the received message increases, the 
information including one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path. 
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73. (Original) The computer-readable storage medium of claim 70 
wherein the score increases as a number of unique users in the network 
accepting messages having the same information about the sender as the 
received message increases, the information including one of the following: 



74. (Original) The computer-readable storage medium of claim 70 
wherein the score decreases as a number of unique users in the network 
rejecting messages having the same information about the sender as the 
received message increases, the information including one of the following: 



75. (Original) The computer-readable storage medium of claim 66, the 
method further comprising determining the final IP address used by the 
sender by identifying an IP address of a first network device used to send 
the e-mail message to a second network device trusted by a recipient of 
the message. 

76. (Original) The computer-readable storage medium of claim 66, the 
method further comprising determining the final domain name used by 
the sender by identifying a domain name of an IP address of a first 
network device used to send the e-mail message to a second network 
device trusted by a recipient of the message. 



a) 
b) 
c) 
d) 



an actual sender; 

a final IP address; 

a final domain name; or 

an IP path. 



a) 
b) 
c) 
d) 



an actual sender; 

a final IP address; 

a final domain name; or 

an IP path. 
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77. (Original) The computer-readable storage medium of claim 76, the 
method further comprising determining the final domain name used by 
the sender by removing a predetermined number of subdomains from the 
domain name of the IP address of the first network device used to send the 
e-mail message to the second network device trusted by the recipient of 
the message. 

78. (Original) The computer-readable storage medium of claim 66, the 
method further comprising creating a whitelist which messages will be 
accepted by a recipient, the accepted messages identified by at least one of 
the following: 



a) 


an e-mail address; 


b) 


an actual sender; 


c) 


a display name; 


d) 


a domain name; 


e) 


a final domain name; 


f) 


a final IP address; and 


g) 


an IP path. 



79. (Original) The computer-readable storage medium of claim 78, the 
method further comprising placing the message in the recipient's inbox if 
the whitelist indicates the recipient will accept the message. 
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80. (Original) The computer-readable storage medium of claim 66, the 
method further comprising creating a blacklist indicating which messages 
will not be accepted by a recipient, the unaccepted messages identified by 
at least one of the following: 

a) an e-mail address; 

b) an actual sender; 

c) a display name; 

d) a domain name; 

e) a final domain name; 

f) a final IP address; and 

g) an IP path. 

81. (Original) The computer-readable storage medium of claim 80, the 
method further comprising disposing of the message if the blacklist 
indicates the recipient will not accept the message, the disposal of the 
message including one of the following: 

a) placing the message in a spam folder; or 

b) deleting the message. 
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1 82. (Original) The computer-readable storage medium of claim 69, the 

2 method further comprising sending information about received messages 

3 to the central database, the information including at least one of the 

4 following: 

5 a) information about the actual sender ; 

6 b) whether the actual sender is included on a recipient's 

7 whitelist; 

8 c) whether the actual sender is included on the 

9 recipient's blacklist; 

10 d) information about the final IP address; 

n e) whether the final IP address is included on the 

12 recipient's whitelist; 

13 f) whether the final IP address is included on the 

14 recipient's blacklist; 

is g) information about the final domain name; 

16 h) whether the final domain name is included on the 

17 recipient's whitelist; 

is i) whether the final domain name is included on the 

19 recipient's blacklist; 

20 j) information about the IP path; 

21 k) whether the IP path is included on the recipient's 

22 whitelist; 

2 3 1) whether the IP path is included on the recipient's 

24 blacklist; 

2 5 m) whether the message could be categorized locally; and 

2 6 n) whether a recipient changed a whitelist/ blacklist 

27 status of the message. 
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83. (Original) The computer-readable storage medium of claim 69, the 
method further comprising requesting the central database to send a 
recipient statistics about at least one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; and 

d) an IP path. 

84. (Original) The computer-readable storage medium of claim 69, the 
method further comprising setting a predetermined threshold for 
accepting messages based on statistics associated with one of the 
following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path. 

85. (Original) The computer-readable storage medium of 84, the method 
further comprising accepting messages when information about the 
message exceeds the predetermined threshold. 
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86. (Original) The computer-readable storage medium of claim 84, the 
method further comprising setting a low threshold to differentiate wanted 
messages from unsolicited messages, wherein the low threshold is either: 

a) greater than one percent of a number of messages sent 
are accepted, wherein the messages are characterized by one of the 
following: 

i) an actual sender; 

ii) a final IP address; 

iii) a final domain name; or 

iv) an IP path; 

b) greater than one percent of a number of unique users 
accepting a message wherein the message is characterized by one of the 
following: 

i) an actual sender; 

ii) a final IP address; 

iii) a final domain name; or 

iv) an IP path. 

87. (Original) The computer-readable storage medium of claim 66, 
wherein processing the received message includes placing the message in 
the recipient's inbox. 

88. (Original) The computer-readable storage medium of claim 66, 
wherein processing the received message includes placing the message in 
a spam folder. 

89. (Original) The computer-readable storage medium of claim 88, the 
method further comprising manually transferring the message from the 
spam folder to the recipient's inbox. 
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90. (Original) The computer-readable storage medium of claim 84, the 
method further comprising each user setting a predetermined 
personalized spam threshold, wherein an incoming message that exceeds 
the spam threshold is sent to a folder designated to hold spam messages. 

91. (Original) The computer-readable storage medium of claim 84, the 
method further comprising each user setting a predetermined 
personalized delete threshold, wherein an incoming message that exceeds 
the delete threshold is deleted. 

92. (Original) The computer-readable storage medium of claim 69, the 
method further comprising evaluating an unknown sender based on 
statistics of one of the following: 



93. (Original) The computer-readable storage medium of claim 69, the 
method further comprising evaluating an unknown sender using either a 
known final IP address or a known final domain name based on statistics 
about other new senders using either the known final IP address or the 
known final domain. 

94. (Original) The computer-readable storage medium of claim 69, the 
method further comprising giving an unknown final IP address or final 
domain name an initial good rating. 

95. (Original) The computer-readable storage medium of claim 69, the 
method further comprising giving an unknown final IP address or domain 
name an initial rating based on the length of time the network has been in 
operation. 



a) 
b) 



a known final IP address used by the sender; or 
a known final domain name used by the sender. 
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96. (Original) The computer-readable storage medium of claim 70, 
wherein a final message score is determined by one of the following: 

a) an average of two scores for a message; or 

b) a product of two scores for the message; 

wherein the scores for messages are based on statistics associated with a 
least two of the following: 

a) an actual sender of the message; 

b) a final IP address used by the sender; 

c) a final domain name used by the sender; or 

d) an IP path used by the sender. 

97. (Original) The computer-readable storage medium of claim 83, 
wherein personal statistics are checked at the local database before global 
statistics at either the central database or the at least two centrally- 
maintained databases are checked. 

98. (Original) The computer-readable storage medium of claim 87, the 
method further comprising monitoring the inbox at predetermined 
intervals to determine whether messages should remain in the inbox. 

99. (Original) The computer-readable storage medium of claim 70, 
wherein a first score for an unknown sender using a known final IP 
address or final domain name may be obtained by multiplying a second 
score for the final IP address or final domain name by a number less than 
one. 
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100. (Original) The computer-readable storage medium of claim 78, the 
method further comprising creating the whitelist by adding the following 
to the whitelist: 

a) any e-mail addresses stored by a user of the e-mail 

program; 

b) any e-mail address in an outgoing message; and 

c) any e-mail address of a sender of a message having the 
same subject line as another message previously sent by the user. 

101. (Original) The method of claim 100 further comprising combining 
each e-mail address added to the whitelist with at least one other piece of 
information from the message header including: 



a) 


a display name used by the sender; 


b) 


a domain name used by the sender; 


c) 


the final IP address used by the sender; 


d) 


the final domain name used by the sender; 


e) 


the name of client software used by the actual sender; 


f) 


user-agent; 


g) 


time zone; 


h) 


source IP address; 


i) 


sendmail version used by a first receiver; and 


j) 


the IP path used to route the message. 
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1 102. (Original) The computer-readable storage medium of claim 100, the 

2 method further comprising: 

3 a) scanning messages received by the user; and 

4 b) determining if a sender of a received message is on the 

5 whitelist, wherein if the sender is on the whitelist: 

6 i) identifying information about the sender of the 

7 message based on data in the message, the identified information about 

8 the sender including at least one of the following: 

9 A) an actual sender of the message; 

10 B) a final IP address used by the sender; 

n C) a final domain name used by the sender; 

12 or 

13 D) an IP path used by the sender; and 

14 ii) sending the identified information to the at least 

15 one database. 

1 103. (Original) The computer-readable storage medium of claim 69, the 

2 method further comprising categorizing a received message that cannot be 

3 rated locally when user activity is observed. 

1 104. (Original) The computer-readable storage medium of claim 70, the 

2 method further comprising using a second formula to compute the score 

3 for the message when the message is reevaluated, wherein the second 

4 formula differs from a first formula used to compute the previous message 

5 score. 

1 105. (Original) The computer-readable storage medium of claim 66, the 

2 method further comprising receiving a notification when any sender's 

3 reputation changes. 
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106. (Original) The computer readable storage medium of claim 105, the 
method further comprising reviewing all messages received in a 
predetermined time period preceding receipt of the notification and 
updating the categorization of the message as necessary. 
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1 107. (Currently amended) In a computer network, a system for 

2 processing received e-mail messages comprising: 

3 a) at least one sending device having a first software 

4 means to send an e-mail message; 

5 b) at least one database in network connection with the 

6 at least one sending device having a second software means for compiling 

7 information about a sender of the e-mail message, wherein the 

8 information about the sender of an e-mail message is used to determine 

9 the likelihood that the e-mail message is unsolicited e-mail, wherein the 
10 compiled information about the sender includes at least one of the 

n following: 

12 i) an actual sender of the message; 

13 ii) a final IP address used by the sender; 

14 iii) a final domain name used by the sender; and 
is iv) an IP path used by the sender; 

16 wherein the at least one database includes one of the following: 

17 i) a central database; 

18 ii) at least two centrally-maintained databases, 

19 each storing and compiling different information and statistics; and 

20 iii) a local database; and 

21 c) at least one recipient in network connection with the 

22 at least one sending device and the central database, wherein the at least 
2 3 one recipient has a third software means for: 

24 i) receiving the e-mail message from the at least 

25 one sending device; 

2 6 ii) identifying information about the sender and 

2 7 sending that information to the at least one database; and 
2 8 iii) receiving information from the at least one 

2 9 database about whether the message is an unsolicited e-mail message. 
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1 108. (Original) The system of claim 107 wherein the central database is 

2 located at a network device. 

1 109. (Original) The system of claim 107 wherein the central database, 

2 the centrally-maintained databases, and the at least one recipient are 

3 members of an e-mail network. 

1 110. (Original) The system of claim 107 further comprising an incoming 

2 mail server in network connection with the at least one recipient. 

1 111. (Original) The system of claim 110 further comprising an outgoing 

2 mail server in network connection with the at least one sending device and 

3 the incoming mail server. 

1 112. (Original) The system of claim 107 further comprising the at least 

2 one recipient having a spam folder. 

1 113. (Original) The system of claim 107 wherein the third software 

2 means identifies the actual sender by a signature including at least two of 

3 the following fields from the message header: 



4 


a) 


an e-mail address used by the sender; 


5 


b) 


a display name used by the sender; 


6 


c) 


a domain name used by the sender; 


7 


d) 


the final IP address used by the sender; 


8 


e) 


the final domain name used by the sender; 


9 


f) 


the name of client software used by the actual sender; 


10 


g) 


user-agent; 


11 


h) 


time zone; 


12 


i) 


source IP address; 


13 


j) 


sendmail version used by a first receiver; and 


14 


k) 


the IP path used to route the message. 
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114. (Original) The system of claim 107 wherein the third software 
means identifies the actual sender by a signature including a range of IP 
addresses and at least one of the following fields from the message header: 



115. (Original) The system of claim 107 wherein the compiled 
information about the sender of the e-mail message includes statistics 
about the actual sender of the message. 

116. (Original) The system of claim 107 further comprising either the 
second software means or the third software means computing a score 
based on the compiled information about the sender, wherein the score 
indicates a likelihood that the received message is unsolicited e-mail. 



a) 
b) 
c) 
d) 
e) 
f) 



an e-mail address used by the sender; 

a display name used by the sender; 

a domain name used by the sender; 

the final IP address used by the sender; 

the final domain name used by the sender; 

the name of client software used by the actual sender; 



g) 

h) 

i) 

j) 

k) 



user-agent; 

time zone; 

source IP address; 

sendmail version used by a first receiver; and 
the IP path used to route the message. 
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117. (Original) The system of claim 116 wherein the score increases as a 
number of accepted messages having the same information about the 
sender as the received message increases, the information including one of 
the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path. 



118. (Original) The system of claim 116 wherein the score decreases as a 
number of rejected messages having the same information about the 
sender as the received message increases, the information including one of 
the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path. 



119. (Original) The system of claim 116 wherein the score increases as a 
number of unique users in the network accepting messages having the 
same information about the sender as the received message increases, the 
information including one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path. 
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120. (Original) The system of claim 116 wherein the score decreases as a 
number of unique users in the network rejecting messages having the 
same information about the sender as the received message increases, the 
rejected messages characterized by one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path. 



121. (Original) The system of claim 107 further comprising the third 
software means determining the final IP address used by the sender by 
identifying an IP address of a first network device used to send the e-mail 
message to a second network device trusted by the recipient receiving the 
message. 



122. (Original) The system of claim 107 further comprising the third 
software means determining the final domain name used by the sender by 
identifying a domain name of an IP address of a first network device used 
to send the e-mail message to a second network device trusted by the 
recipient receiving the message. 



123. (Original) The system of claim 122 further comprising the third 
software means determining the final domain name by removing a 
predetermined number of subdomains from the domain name of the IP 
address of the first network device used to send the e-mail message to the 
second network device trusted by the recipient of the message. 
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124. (Original) The system of claim 107 further comprising the third- 
software means creating a whitelist indicating which messages will be 
accepted by a recipient, the accepted messages identified by at least one 
the following: 



a) 


an e-mail address; 


b) 


an actual sender; 


c) 


a display name; 


d) 


a domain name; 


e) 


a final domain name; 


f) 


a final IP address; and 


g) 


an IP path. 



125. (Original) The system of claim 124 further comprising the third 
software means placing the message in the recipient's inbox if the 
whitelist indicates the recipient will accept the message. 

126. (Original) The system of claim 107 further comprising the third 
software means creating a blacklist indicating which indicates which 
messages will not be accepted by a recipient, the unaccepted messages 
identified by at least one of the following: 

a) an e-mail address; 

b) an actual sender; 

c) a display name; 

d) a domain name; 

e) a final domain name; 

f) a final IP address; and 

g) an IP path. 
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127. (Original) The system of claim 126 further comprising the third 
software means disposing of the message if the blacklist indicates the 
recipient will not accept the message, the disposal of the message 
including one of the following: 

a) placing the message in a spam folder; or 

b) deleting the message. 
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1 128. (Original) The system of claim 107 further comprising the third 

2 software means sending information about received messages to the at 

3 least one database, the information including at least one of the following: 

4 a) information about the actual sender; 

5 b) whether the actual sender is included on a recipient's 

6 whitelist; 

7 c) whether the actual sender is included on a recipient's 

8 blacklist; 

9 d) information about the final IP address; 

10 e) whether the final IP address is included on the 

n recipient's whitelist; 

12 f) whether the final IP address is included on the 

13 recipient's blacklist; 

14 g) information about the final domain name; 

is h) whether the final domain name is included on the 

16 recipient's whitelist; 

17 i) whether the final domain name is included on the 
is recipient's blacklist; 

19 j) information about the IP path; 

20 k) whether the IP path is included on the recipient's 

2 1 whitelist; 

22 1) whether the IP path is included on the recipient's 
2 3 blacklist; 

24 m) whether the message could be categorized locally; and 

25 n) whether a recipient changed a whitelist/ blacklist 
2 6 status of the message. 

1 129. (Original) The system of claim 107 further comprising the second 

2 software means storing information about received messages at the at 

3 least one database. 
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130. (Original) The system of claim 107 further comprising the third 
software means requesting the at least one database to send the recipient 
statistics about at least one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; and 

d) an IP path. 
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1 131. (Original) The system of claim 129 wherein the stored information 

2 includes at least one of the following about messages sent by the actual 

3 sender: 

4 a) a total number of messages sent; 

5 b) a number of messages sent over a first predetermined 

6 time period; 

7 c) a total number of messages sent to recipients in the 

8 network who have included the actual sender on a whitelist; 

9 d) a number of messages sent to recipients in the network 
10 who have included the actual sender on the whitelist over a second 

n predetermined time period; 

12 e) a number of recipients who know the actual sender; 

13 f) a total number of times a recipient changed an actual 

14 sender's white list/blacklist status; 

15 g) a number of times a recipient changed an actual 

16 sender's white list/blacklist status over a third predetermined time period; 

17 h) a total number of messages sent to recipients in the 

18 network who don't know the actual sender; 

19 i) a number of messages sent to recipients in the network 
2 o who don't know the actual sender over a fourth predetermined time 

21 period; 

22 j) a total number of unique recipients in the network who 
2 3 have received at least one message from the actual sender; 

2 4 k) a total number of messages sent to unique recipients in 

2 5 a network who have included the actual sender on a whitelist; and 
2 6 1) a total number of messages sent to unique recipients in 

2 7 the network who have not included the actual sender on the whitelist. 
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1 132. (Original) The system of claim 129 wherein the stored information 

2 includes at least one of the following about messages sent from a final IP 

3 address: 

4 a) a total number of messages sent; 

5 b) a number of messages sent over a first predetermined 

6 time period; 

7 c) a total number of messages sent to recipients in the 

8 network who have included a sender on a whitelist; 

9 d) a number of messages sent to recipients in the network 
10 who have included the sender on the whitelist over a second 

n predetermined time period; 

12 e) a number of recipients who have whitelisted senders 

13 having the final IP address; 

14 f) a total number of times a recipient changed a 

15 whitelist/blacklist status of any sender using the final IP address; 

16 g) a number of times a recipient changed the 

17 whitelist/blacklist status of any sender using the final IP address over a 
is third predetermined time period; 

19 h) a total number of messages sent to recipients in the 

20 network who have not included the sender on the whitelist; 

21 i) a number of messages sent to recipients in the network 

22 who have not included the sender on the whitelist over a fourth 
2 3 predetermined time period; 

2 4 j) a total number of unique recipients in the network who 

25 have received at least one message from at least one sender using the final 

2 6 IP address; 

2 7 k) a total number of messages sent to unique recipients in 

2 8 the network who have included the sender on the whitelist; and 

29 1) a total number of messages sent to unique recipients in 

3 o the network who have not included the sender on the whitelist. 
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1 133. (Original) The system of claim 129 wherein the stored information 

2 includes at least one of the following about messages sent from a final 

3 domain name: 

4 a) a total number of messages sent; 

5 b) a number of messages sent over a first predetermined 

6 time period; 

7 c) a total number of messages sent to recipients in the 

8 network who have included a sender on a whitelist; 

9 d) a number of messages sent to recipients in the network 
10 who have included the sender on the whitelist over a second 

n predetermined time period; 

12 e) a number of recipients who have whitelisted senders 

13 using the final domain name; 

14 f) a total number of times a recipient changed a 

15 whitelist/blacklist status of any sender using the final domain name; 

16 g) a number of times a recipient changed the 

17 whitelist/blacklist status of any sender using the final domain name over 

18 a third predetermined time period; 

19 h) a total number of messages sent to recipients in the 

20 network who have not included the sender on the whitelist; 

21 i) a number of messages sent to recipients in the network 

22 who have not included the sender on the whitelist over a fourth 
2 3 predetermined time period; 

24 j) a total number of unique recipients in the network who 

25 have received at least one message from at least one sender using the final 
2 6 domain name; 

27 k) a total number of messages sent to unique recipients in 

2 8 the network who have included the sender on the whitelist; and 

29 1) a total number of messages sent to unique recipients in 

30 the network who have not included the sender on the whitelist. 
l 
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1 134. (Original) The system of claim 129 wherein the stored information 

2 includes at least one of the following about messages sent using an IP 

3 path: 

4 a) a total number of messages sent; 

5 b) a number of messages sent over a first predetermined 

6 time period; 

7 c) a total number of messages sent to recipients in the 

8 network who have included a sender on a whitelist; 

9 d) a number of messages sent to recipients in the network 

10 who have included the sender on the whitelist over a second 

11 predetermined time period; 

12 e) a number of recipients who have whitelisted senders 

13 using the IP path; 

14 f) a total number of times a recipient changed a 

15 whitelist/blacklist status of any sender using the IP path; 

16 g) a number of times a recipient changed the 

17 whitelist/blacklist status of any sender using the IP path over a third 

18 predetermined time period; 

19 h) a total number of messages sent to recipients in the 

20 network who have not included the sender on the whitelist; 

21 i) a number of messages sent to recipients in the network 

22 who have not included the sender on the whitelist over a fourth 

23 predetermined time period; 

2 4 j) a total number of unique recipients in the network who 

25 have received at least one message from at least one sender using the IP 

2 6 path; 

2 7 k) a total number of messages sent to unique recipients in 

2 8 the network who have included the sender on the whitelist; and 

2 9 1) a total number of messages sent to unique recipients in 

3 0 the network who have not included the sender on the whitelist. 
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1 135. (Original) The system of claim 115 further comprising the second 

2 software means compiling statistics by doing at least one of the following: 

3 a) determining a ratio of a first number e-mail messages 

4 sent by an actual sender to recipients in the network who have included 

5 the sender on the whitelist in a predetermined time period divided by a 

6 second number of e-mail messages sent by an actual sender to users in the 

7 network in the predetermined time period; 

8 b) determining a ratio of a first number of recipients in 

9 the network who have included the sender on the whitelist divided by a 
10 second number of unique recipients in the network who received e-mails 
n from the actual sender in a predetermined time period; 

12 c) determining a ratio of a first number of times in a 

13 predetermined time interval a message from the actual sender was moved 

14 from a whitelist to a blacklist divided by a second number of times a 

is message from the actual sender was moved from a whitelist to a blacklist; 

16 d) determining a ratio of a first number of times in a 

17 predetermined time interval a message from the actual sender was moved 

18 from a blacklist to a whitelist divided by a second number of times a 

19 message from the actual sender was moved from a blacklist to a whitelist; 

20 e) determining a ratio of a first number of unique users 

21 within a network who white listed an actual sender within a 

22 predetermined time period compared to a second number of unique users 

23 within a network who blacklisted the actual sender within the 

24 predetermined time period; 

25 f) determining a ratio reflecting whether an actual 
2 6 sender sends a majority of messages to known recipients; 

2 7 g) determining a ratio reflecting a first number of wanted 

2 8 messages sent by the actual sender compared to a second number of 

2 9 unwanted or total messages sent by the actual sender; 
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h) determining a difference between a first number of 
expected messages sent by the actual sender and a second number of 
unexpected messages sent by the actual sender; 

i) determining a difference between a first number of 
times a user whitelisted a message from an actual sender and a number of 
times a user blacklisted a message from the actual sender; 

j) determining a difference reflecting whether the actual 
sender sends a majority of messages to known recipients; and 

k) converting any of the ratios or differences to a score 
indicating the likelihood the message is unsolicited e-mail. 
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1 136. (Original) The system of claim 115 further comprising the second 

2 software means compiling statistics by doing at least one of the following: 

3 a) determining a ratio of a first number e-mail messages 

4 sent by any sender using a final IP address to recipients in the network 

5 who have included the sender on the whitelist in a predetermined time 

6 period divided by a second number of e-mail messages sent by an any 

7 sender using the final IP address to users in the network in the 

8 predetermined time period; 

9 b) determining a ratio of a first number of recipients in 
10 the network who have included the sender on the whitelist divided by a 
n second number of unique recipients in the network who received e-mails 

12 from any sender using the final IP address in a predetermined time 

13 period; 

14 c) determining a ratio of a first number of times in a 

15 predetermined time interval a message from any sender using the final IP 

16 address was moved from a whitelist to a blacklist divided by a second 

17 number of times a message from any sender using the final IP address 

18 was moved from a whitelist to a blacklist; 

19 d) determining a ratio of a first number of times in a 

20 predetermined time interval a message from any sender using the final IP 

21 address was moved from a blacklist to a whitelist divided by a second 

22 number of times a message from any sender using the final IP address 

23 was moved from a blacklist to a whitelist; 

2 4 e) determining a ratio of a first number of unique users 

2 5 within a network who whitelisted any sender using the final IP address 

2 6 within a predetermined time period compared to a second number of 

27 unique users within a network who blacklisted any sender using the final 

2 8 IP address within the predetermined time period; 

2 9 f) determining a ratio reflecting whether any sender 

3 0 using the final IP address sends a majority of messages to recipients who 
31 have included the sender on the whitelist; 
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3 2 g) determining a ratio reflecting a first number of wanted 

33 messages sent by any sender using the final IP address compared to a 

34 second number of unwanted or total messages sent by any sender using 
3 5 the final IP address; 

3 6 h) determining a difference between a first number of 

37 expected messages sent by any sender using the final IP address and a 

3 8 second number of unexpected messages sent by any sender using the final 

3 9 IP address; 

4 0 i) determining a difference between a first number of 

41 times a user whitelisted a message from any sender using the final IP 

42 address and a second number of times a user blacklisted a message from 

43 any sender using the final IP address; 

44 j) determining a difference reflecting whether any sender 

45 using the final IP address sends a majority of messages to recipients who 
4 6 have included the sender on the whitelist; and 

47 k) converting any of the above ratios or differences to a 

48 score indicating the likelihood is unsolicited e-mail. 
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1 137. (Original) The system of claim 115 further comprising the second 

2 software means compiling statistics by doing at least one of the following: 

3 a) determining a ratio of a first number e-mail messages 

4 sent by any sender using a final domain name to recipients in the network 

5 who have included the sender on the whitelist in a predetermined time 

6 period divided by a second number of e-mail messages sent by an any 

7 sender using the final domain name to users in the network in the 

8 predetermined time period; 

9 b) determining a ratio of a first number of recipients in 

10 the network who have included the sender on the whitelist divided by a 

11 second number of unique recipients in the network who received e-mails 

12 from any sender using the final domain name in a predetermined time 

13 period; 

14 c) determining a ratio of a first number of times in a 

15 predetermined time interval a message from any sender using the final 

16 domain name was moved from a whitelist to a blacklist divided by a 

17 second number of times a message from any sender using the final domain 

18 name was moved from a whitelist to a blacklist; 

19 d) determining a ratio of a first number of times in a 

20 predetermined time interval a message from any sender using the final 
2 i domain name was moved from a blacklist to a whitelist divided by a 

22 second number of times a message from any sender using the final domain 

2 3 name was moved from a blacklist to a whitelist; 

24 e) determining a ratio of a first number of unique users 

2 5 within a network who white listed any sender using the final domain name 

2 6 within a predetermined time period compared to a second number of 

2 7 unique users within a network who blacklisted any sender using the final 

2 8 domain name within the predetermined time period; 

29 f) determining a ratio reflecting whether any sender 

3 0 using the final domain name sends a majority of messages to recipients 
31 who have included the sender on the whitelist; 
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32 g) determining a ratio reflecting a first number of wanted 

33 messages sent by any sender using the final domain name compared to a 

34 second number of unwanted or total messages sent by any sender using 

35 the final domain name; 

3 6 h) determining a difference between a first number of 

37 expected messages sent by any sender using the final domain name and a 

3 8 second number of unexpected messages sent by any sender using the final 

3 9 domain name; 

40 i) determining a difference between a first number of 

41 times a user white listed a message from any sender using the final 

42 domain name and a second number of times a user blacklisted a message 

4 3 from any sender using the final domain name; 

44 j) determining a difference reflecting whether any sender 

45 using the final domain name sends a majority of messages to recipients 
4 6 who have included the sender on the whitelist; and 

4 7 k) converting any of the above ratios or differences to a 

4 8 score indicating the likelihood is unsolicited e-mail. 
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1 138. (Original) The system of claim 115 further comprising the second 

2 software means compiling statistics by doing at least one of the following: 

3 a) determining a ratio of a first number e-mail messages 

4 sent by any sender using an IP path to recipients in the network who have 

5 included the sender on the whitelist in a predetermined time period 

6 divided by a second number of e-mail messages sent by an any sender 

7 using the IP path to users in the network in the predetermined time 

8 period; 

9 b) determining a ratio of a first number of recipients in 
10 the network who have included the sender on the whitelist divided by a 
n second number of unique recipients in the network who received e-mails 

12 from any sender using the IP path in a predetermined time period; 

13 c) determining a ratio of a first number of times in a 

14 predetermined time interval a message from any sender using the IP path 
is was moved from a whitelist to a blacklist divided by a second number of 
is times a message from any sender using the IP path was moved from a 

17 whitelist to a blacklist; 

18 d) determining a ratio of a first number of times in a 

19 predetermined time interval a message from any sender using the IP path 

20 was moved from a blacklist to a whitelist divided by a second number of 

21 times a message from any sender using the IP path was moved from a 

22 blacklist to a whitelist; 

23 e) determining a ratio of a first number of unique users 

24 within a network who white listed any sender using the IP path within a 
2 5 predetermined time period compared to a second number of unique users 
2 6 within a network who blacklisted any sender using the IP path within the 
27 predetermined time period; 

2 8 f) determining a ratio reflecting whether any sender 

2 9 using the IP path sends a majority of messages to recipients who have 

3 0 included the sender on the whitelist; 
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31 g) determining a ratio reflecting a first number of wanted 

32 messages sent by any sender using the IP path compared to a second 

33 number of unwanted or total messages sent by any sender using the IP 

34 path; 

35 h) determining a difference between a first number of 
3 6 expected messages sent by any sender using the IP path and a second 
37 number of unexpected messages sent by any sender using the IP path; 
3 8 i) determining a difference between a first number of 

3 9 times a user whitelisted a message from any sender using the IP path and 

40 a second number of times a user blacklisted a message from any sender 

41 using the IP path; 

42 j) determining a difference reflecting whether any sender 

43 using the IP path sends a majority of messages to recipients who have 

44 included the sender on the whitelist; and 

45 k) converting any of the above ratios or differences to a 

4 6 score indicating the likelihood is unsolicited e-mail. 

1 139. (Original) The system of claim 116 further comprising the second 

2 software means applying the score received from the at least one database 

3 to a message in a spam folder. 

1 140. (Original) The system of claim 107 further comprising the third 

2 software means setting a predetermined threshold for accepting messages 

3 based on statistics associated with one of the following: 

4 a) an actual sender; 

5 b) a final IP address; 

6 c) a final domain name; 

7 d) an IP path. 
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141. (Original) The system of claim 140 further comprising the third 
software means accepting messages when information about the message 
exceeds the predetermined threshold. 

142. (Original) The system of claim 140 further comprising the third 
software means setting a low threshold to differentiate wanted messages 
from unsolicited messages, wherein the low threshold is either: 

a) greater than one percent of a number of messages are 
accepted, wherein the messages are characterized by one of the following: 

i) an actual sender; 

ii) a final IP address; 

iii) a final domain name; or 

iv) an IP path; 

b) greater than one percent of a number of unique users 
accepting a message wherein the message is characterized by one of the 
following: 

i) an actual sender; 

ii) a final IP address; 

iii) a final domain name; or 

iv) an IP path. 

143. (Original) The system of claim 107 further comprising the second 
software means revising statistics when a recipient changes a 
whitelist/blacklist status of one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path. 
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144. (Original) The system of claim 107 further comprising the third 
software means creating a key for storing information about the actual 
sender. 



145. (Original) The system of claim 144 wherein the key is the 
information used to identify the actual sender. 

146. (Original) The system of claim 107 further comprising the third 
software means placing an accepted message in the recipient's inbox. 

147. (Original) The system of claim 107 further comprising the third 
software means placing the message in a spam folder. 

148. (Original) The system of claim 147 further comprising the second 
software means monitoring the spam folder at predetermined intervals to 
determine whether messages should be released. 

149. (Original) The system of claim 148 further comprising the second 
software means automatically releasing the message from the spam folder 
when the reputation of one of the following: 



d) the IP path; 
passes a predetermined threshold. 

150. (Original) The system of claim 148 further comprising the second 
software means reevaluating the spam folder immediately before it is 
displayed to a user such that information about messages in the spam 
folder is current when viewed by the user. 



a) 
b) 
c) 



the actual sender; 

the final IP address; 

the final domain name; or 
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151. (Original) The system of claim 107 wherein the network is the 
Internet. 

152. (Original) The system of claim 110 wherein the central database is 
located at the incoming mail server. 

153. (Original) The system of claim 107 further comprising the second 
software means sending the recipient information about at least one of the 
following: 

a) the actual sender; 

b) the final IP address; 

c) the final domain name; and 

d) the IP path. 

154. (Original) The system of claim 153 further comprising the second 
software means sending the recipient information about at least one of the 
following: 

a) the final IP address; 

b) the final domain name; and 

c) the IP path; 

when there is insufficient information about the actual sender. 

155. (Original) The system of claim 143 wherein a manual reversal of a 
whitelist/blacklist status is more heavily weighted when revising 
statistics. 

156. (Original) The system of claim 107 wherein each of the at least two 
centrally- maintained databases is located at a network device. 

157. (Original) The system of claim 107 wherein the local database is 
located at the recipient. 

-68- 



A7:ABC-007.AMT 



158. (Original) The system of claim 140 further comprising the third 
software means setting a predetermined personalized spam threshold, 
wherein an incoming message that exceeds the spam threshold is sent to a 
folder designated to hold spam messages. 



159. (Original) The system of claim 140 further comprising the third 
software means setting a predetermined personalized delete threshold, 
wherein an incoming message that exceeds the delete threshold is deleted. 



160. (Original) The system of claim 107 further comprising the second 
software means maintaining at either the central database or the at least 
two centrally-maintained databases at least four of the following values: 

a) a number of messages which were explicitly ranked 

good; 

b) a number of messages which were implicitly ranked 

good; 

c) a number of messages whose ranking is unknown; 

d) a number of messages which were explicitly ranked 

bad; and 

e) a number of messages which were implicitly ranked 

bad; 

wherein the values are based on messages having the same 
information about the sender including one of the following: 

i) an actual sender; 

ii) a final IP address used by the sender; 

iii) a final domain name used by the sender; or 

iv) an IP path used by the sender. 
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161. (Original) The system of claim 160 wherein the values represent one 
of the following: 

a) message counts; or 

b) ratings of unique users within the network. 

162. (Original) The system of claim 161 further comprising the second 
software means returning at least four of the values to the recipient to 
allow the recipient to apply different weights to a message in order to 
categorize the message. 

163. (Original) The system of claim 107 further comprising the second 
software means evaluating an unknown sender based on statistics of one 
of the following: 

a) a known final IP address used by the sender; or 

b) a known final domain name used by the sender. 

164. (Original) The system of claim 107 further comprising the second 
software means evaluating an unknown sender using either a known final 
IP address or a known final domain name based on statistics about other 
new senders using either the known final IP address or the known final 
domain. 

165. (Original) The system of claim 107 further comprising the second 
software means giving an unknown final IP address or final domain name 
an initial good rating. 

166. (Original) The system of claim 107 further comprising the second 
software means giving an unknown final IP address or domain name an 
initial rating based on the length of time the network has been in 
operation. 
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167. (Original) The system of claim 128 further comprising the second 
software means overwriting new member's message ratings when the new 
member's ratings are inconsistent when compared to older network 
members' ratings. 

168. (Original) The system of claim 116 wherein a final message score is 
determined by one of the following: 

a) an average of two scores for a message; or 

b) a product of two scores for the message; 
wherein the scores for messages are based on statistics 

associated with a least two of the following: 

i) an actual sender of the message; 

ii) a final IP address used by the sender; 

iii) a final domain name used by the sender; or 

iv) an IP path used by the sender. 

169. (Original) The system of claim 130 wherein personal statistics are 
checked at the local database before global statistics at either the central 
database or the at least two centrally-maintained databases are checked. 

170. (Original) The system of claim 107 further comprising the second 
software means rating a sender by: 

a) releasing small numbers of a sender's messages to 
recipients; and 

b) monitoring the recipients' classification of these 

messages. 

171. (Original) The system of claim 107 further comprising the second 
software means changing one user's rating when other members outvote 
the user's rating. 
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172. (Original) The system of claim 130 wherein either the central 
database or the at least two centrally-maintained databases return more 
than one value to the recipient. 

173. (Original) The system of claim 146 further comprising monitoring 
the inbox at predetermined intervals to determine whether messages 
should remain in the inbox. 

174. (Original) The system of claim 116 wherein a first score for an 
unknown sender using a known final IP address or final domain name 
may be obtained by multiplying a second score for the final IP address or 
final domain name by a number less than one. 

175. (Original) The system of claim 124 further comprising the third 
software means creating the whitelist by adding the following to the 
white list: 

a) any e-mail addresses stored by a user of the e-mail 

program; 

b) any e-mail address in an outgoing message; and 

c) any e-mail address of a sender of a message having the 
same subject line as another message previously sent by the user. 
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176. (Original) The system of claim 175 further comprising the third 
software means: 

a) scanning messages received by the user; and 

b) determining if a sender of a received message is on the 
whitelist, wherein if the sender is on the whitelist: 

i) identifying information about the sender of the 
message based on data in the message, the identified information about 
the sender including at least one of the following: 

A) an actual sender of the message ; 

B) a final IP address used by the sender; 

C) a final domain name used by the sender; 



or 



D) an IP path used by the sender; and 
ii) sending the identified information to the at least 



one database. 



177. (Original) The system of claim 107 further comprising the third 
software means categorizing a received message that cannot be rated 
locally when user activity is observed. 



178. (Original) The system of claim 116 further comprising the second or 
third software means using a second formula to compute the score for the 
message when the message is reevaluated, wherein the second formula 
differs from a first formula used to compute the previous message score. 

179. (Original) The system of claim 107 further comprising the second 
software means sending recipients a notification when any sender's 
reputation changes. 
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1 180. (Original) The system of claim 179 further comprising the third 

2 software means reviewing all messages received in a predetermined time 

3 period preceding receipt of the notification and updating the 

4 categorization of the message as necessary. 

1 181. (Original) A method of processing received e-mail messages 

2 comprising: 

3 a) identifying information about a sender of a received e- 

4 mail message based on data in the message, the information about the 

5 sender including at least one of the following: 

6 i) an actual sender; 

7 ii) a final IP address used by the sender; 

8 iii) a final domain name used by the sender; and 

9 iv) an IP path used by the sender; 

10 b) compiling information about the sender at at least one 

n database, wherein the at least one database includes one of the following: 

12 i) a central database; 

13 ii) at least two centrally-maintained databases, 

14 each storing and compiling different information and statistics; and 

15 iii) a local database; 

16 c) using compiled information about the sender to 

17 categorize whether the received message is unsolicited e-mail; and 

18 d) processing the received message based on its 

1 9 cate gorization. 
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182. (Original) The method of claim 181 wherein the actual sender is 
identified by a signature including at least two of the following fields from 
the message header: 



a) 


an e-mail address used by the sender; 


b) 


a display name used by the sender; 


c) 


a domain name used by the sender; 


d) 


the final IP address used by the sender; 


e) 


the final domain name used hv the sender* 




the name of client software used by the actual sender; 


g) 


user-agent; 


h) 


time zone; 


i) 


source IP address; 


j) 


sendmail version used by a first receiver; and 


k) 


the IP path used to route the message. 



183. (Original) The method of claim 181 wherein the actual sender is 
identified by a signature including a range of IP addresses and at least 
one of the following fields from the message header: 



a) 


an e-mail address used by the sender; 


b) 


a display name used by the sender; 


c) 


a domain name used by the sender; 


d) 


the final IP address used by the sender; 


e) 


the final domain name used by the sender; 


f) 


the name of client software used by the actual sender; 


g) 


user-agent; 


h) 


timezone; 


i) 


source IP address; 


j) 


sendmail version used by a first receiver; and 


k) 


the IP path used to route the message. 
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184. (Original) The method of claim 181 further comprising applying a 
score indicating a likelihood that the received message is unsolicited e- 
mail based on the compiled statistics to the received message in a spam 
folder. 

185. (Original) The method of claim 181 wherein the score increases as a 
number of accepted messages having the same information about the 
sender as the received message increases, the information including of the 
following: 



186. (Original) The method of claim 181 wherein the score decreases as a 
number of rejected messages having the same information about the 
sender as the received message increases, the information including one of 
the following: 



187. (Original) The method of claim 181 wherein the score increases as a 
number of unique users in the network accepting messages having the 
same information about the sender as the received message increases, the 
information including one of the following: 



a) 
b) 
c) 
d) 



an actual sender; 

any sender using the final IP address; 
any sender using the final domain name; 
any sender using a particular IP path. 



a) 
b) 
c) 
d) 



an actual sender; 

a final IP address used by the sender; 
a final domain name used by the sender; 
an IP path used by the sender. 



a) 
b) 
c) 
d) 



an actual sender; 

a final IP address used by the sender; 
a final domain name used by the sender; 
an IP path used by the sender. 
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188. (Original) The method of claim 181 wherein the score decreases as a 
number of unique users in the network rejecting messages having the 
same information about the sender as the received message increases, the 
information including one of the following: 



189. (Original) The method of claim 181 further comprising determining 
the final IP address by identifying an IP address of a first network device 
used to send the e-mail message to a second network device trusted by a 
recipient of the message. 

190. (Original) The method of claim 181 further comprising determining 
the final domain name by identifying a domain name of an IP address of a 
first network device used to send the e-mail message to a second network 
device trusted by a recipient of the message. 

191. (Original) The method of claim 190 further comprising determining 
the final domain name used by the sender by removing a predetermined 
number of subdomains from the domain name of the IP address of the first 
network device used to send the e-mail message to the second network 
device trusted by the recipient of the message. 



a) 
b) 
c) 
d) 



an actual sender; 

a final IP address used by the sender; 
a final domain name used by the sender; 
an IP path used by the sender. 
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192. (Original) The method of claim 181 further comprising creating a 
whitelist indicating which messages will be accepted by a recipient, the 
accepted messages identified by at least one of the following: 



a) 


an e-mail address; 


b) 


an actual sender; 


c) 


a display name; 


d) 


a domain name; 


e) 


a final domain name; 


f> 


a final IP address; and 


g) 


an IP path. 



193. (Original) The method of claim 192 further comprising placing the 
message in the recipient's inbox if the whitelist indicates the recipient will 
accept the message. 

194. (Original) The method of claim 181 further comprising creating a 
blacklist which indicates which messages will not be accepted by a 
recipient, the unaccepted messages identified by at least one of the 
following: 

a) an e-mail address; 

b) an actual sender; 

c) a display name; 

d) a domain name; 

e) a final domain name; 

f) a final IP address; and 

g) an IP path. 
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195. (Original) The method of claim 194 further comprising disposing of 
the message if the blacklist indicates the recipient will not accept the 
message, the disposal of the message including one of the following: 

a) placing the message in a spam folder; or 

b) deleting the message. 
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1 196. (Original) The method of claim 181 further comprising sending 

2 information about received messages to the at least one database, the 

3 information including at least two of the following: 

4 a) information about the actual sender; 

5 b) whether the actual sender is included on a recipient's 

6 whitelist; 

7 c) whether the actual sender is included on the 

8 recipient's blacklist; 

9 d) information about the final IP address; 

10 e) whether the final IP address is included on the 

n recipient's whitelist; 

12 f) whether the final IP address is included on the 

13 recipient's blacklist; 

14 g) information about the final domain name; 

is h) whether the final domain name is included on the 

16 recipient's whitelist; 

17 i) whether the final domain name is included on the 

18 recipient's blacklist; 

19 j) information about the IP path; 

20 k) whether the IP path is included on the recipient's 

21 whitelist; 

22 1) whether the IP path is included on the recipient's 

23 blacklist; 

24 m) whether the message could be categorized locally; and 

25 n) whether a recipient changed a whitelist/ blacklist 
2 6 status of the message. 

1 197. (Original) The method of claim 196 further comprising storing 

2 information about received messages at the at least one database. 
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198. (Original) The method of claim 181 further comprising requesting 
the at least one database to send a recipient statistics about at least one of 
the following: 

a) the actual sender; 

b) the final IP address; 

c) the final domain name; and 

d) the IP path. 

199. (Original) The method of claim 181 further comprising sending the 
recipient statistics about at least one of the following: 

a) the actual sender; 

b) the final IP address; 

c) the final domain name; and 

d) the IP path. 
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1 200. (Original) The method of claim 197 further comprising storing 

2 information about messages sent from an actual sender including at least 

3 one of the following: 

4 a) a total number of messages sent; 

5 b) a number of messages sent over a first predetermined 

6 time period; 

7 c) a total number of messages sent to recipients in the 

8 network who have included the actual sender on a whitelist; 

9 d) a number of messages sent to recipients in the network 
10 who have included the actual sender on the whitelist over a second 

n predetermined time period; 

12 e) a number of recipients who know the actual sender; 

13 f) a total number of times a recipient changed an actual 

14 sender's whitelist/blacklist status; 

is g) a number of times a recipient changed an actual 

16 sender's whitelist/blacklist status over a third predetermined time period; 

17 h) a total number of messages sent to recipients in the 

18 network who don't know the actual sender; 

19 i) a number of messages sent to recipients in the network 

20 who don't know the actual sender over a fourth predetermined time 

21 period; 

22 j) a total number of unique recipients in the network who 

23 have received at least one message from the actual sender; 

24 k) a total number of messages sent to unique recipients in 

25 a network who have included the actual sender on a whitelist; and 

2 6 1) a total number of messages sent to unique recipients in 

27 the network who have not included the actual sender on the whitelist. 
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1 201. (Original) The method of claim 197 further comprising storing 

2 information about messages sent from a final IP address including at least 

3 one of the following: 

4 a) a total number of messages sent; 

5 b) a number of messages sent over a first predetermined 

6 time period; 

7 c) a total number of messages sent to recipients in the 

8 network who have included a sender on a whitelist; 

9 d) a number of messages sent to recipients in the network 

10 who have included the sender on the whitelist over a second 

11 predetermined time period; 

12 e) a number of recipients who have whitelisted senders 

13 having the final IP address; 

14 f) a total number of times a recipient changed a 

15 whitelist/blacklist status of any sender using the final IP address; 

16 g) a number of times a recipient changed the 

17 whitelist/blacklist status of any sender using the final IP address over a 
is third predetermined time period; 

19 h) a total number of messages sent to recipients in the 

20 network who have not included the sender on the whitelist; 

21 i) a number of messages sent to recipients in the network 

22 who have not included the sender on the whitelist over a fourth 

23 predetermined time period; 

24 j) a total number of unique recipients in the network who 

25 have received at least one message from at least one sender using the final 

26 IP address; 

27 k) a total number of messages sent to unique recipients in 

2 8 the network who have included the sender on the whitelist; and 

29 1) a total number of messages sent to unique recipients in 

3 0 the network who have not included the sender on the whitelist. 
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1 202. (Original) The method of claim 197 further comprising storing 

2 information about messages sent from a final domain name including at 

3 least one of the following: 

4 a) a total number of messages sent; 

s b) a number of messages sent over a first predetermined 

6 time period; 

7 c) a total number of messages sent to recipients in the 

8 network who have included a sender on a whitelist; 

9 d) a number of messages sent to recipients in the network 
10 who have included the sender on the whitelist over a second 

n predetermined time period; 

12 e) a number of recipients who have whitelisted senders 

13 using the final domain name; 

14 f) a total number of times a recipient changed a 

15 whitelist/blacklist status of any sender using the final domain name; 

16 g) a number of times a recipient changed the 

17 whitelist/blacklist status of any sender using the final domain name over 
is a third predetermined time period; 

19 h) a total number of messages sent to recipients in the 

20 network who have not included the sender on the whitelist; 

21 i) a number of messages sent to recipients in the network 

22 who have not included the sender on the whitelist over a fourth 
2 3 predetermined time period; 

24 j) a total number of unique recipients in the network who 

25 have received at least one message from at least one sender using the final 
2 6 domain name ; 

2 7 k) a total number of messages sent to unique recipients in 

2 8 the network who have included the sender on the whitelist; and 

29 1) a total number of messages sent to unique recipients in 

3 0 the network who have not included the sender on the whitelist. 
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1 203. (Original) The method of claim 197 further comprising storing 

2 information about messages sent using an IP path including at least one 

3 of the following: 

4 a) a total number of messages sent; 

5 b) a number of messages sent over a first predetermined 

6 time period; 

7 c) a total number of messages sent to recipients in the 

8 network who have included a sender on a whitelist; 

9 d) a number of messages sent to recipients in the network 
10 who have included the sender on the whitelist over a second 

n predetermined time period; 

12 e) a number of recipients who have whitelisted senders 

13 using the IP path; 

14 f) a total number of times a recipient changed a 

15 whitelist/blacklist status of any sender using the IP path; 

16 g) a number of times a recipient changed the 

17 whitelist/blacklist status of any sender using the IP path over a third 

18 predetermined time period; 

19 h) a total number of messages sent to recipients in the 

20 network who have not included the sender on the whitelist; 

21 i) a number of messages sent to recipients in the network 

22 who have not included the sender on the whitelist over a fourth 

23 predetermined time period; 

24 j) a total number of unique recipients in the network who 

25 have received at least one message from at least one sender using the IP 

26 path; 

27 k) a total number of messages sent to unique recipients in 

2 8 the network who have included the sender on the whitelist; and 

29 1) a total number of messages sent to unique recipients in 

3 0 the network who have not included the sender on the whitelist. 
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1 204. (Original) The method of claim 181 wherein compiling statistics 

2 includes at least one of the following: 

3 a) determining a ratio of a first number e-mail messages 

4 sent by an actual sender to recipients who know the actual sender in a 

5 predetermined time period divided by a second number of e-mail messages 

6 sent by an actual sender to users in the network in the predetermined 

7 time period; 

8 b) determining a ratio of a first number of recipients who 

9 know the actual sender divided by a second number of unique recipients in 
10 the network who received e-mails from the actual sender in a 

n predetermined time period; 

12 c) determining a ratio of a first number of times in a 

13 predetermined time interval a message from the actual sender was moved 

14 from a whitelist to a blacklist divided by a second number of times a 

is message from the actual sender was moved from a whitelist to a blacklist; 

16 d) determining a ratio of a first number of times in a 

17 predetermined time interval a message from the actual sender was moved 

18 from a blacklist to a whitelist divided by a second number of times a 

19 message from the actual sender was moved from a blacklist to a whitelist; 

20 e) determining a ratio of a first number of unique users 

21 within a network who whitelisted an actual sender within a 

22 predetermined time period compared to a second number of unique users 

23 within the network who blacklisted the actual sender within the 

24 predetermined time period; 

25 f) determining a ratio reflecting whether an actual 
2 6 sender sends a majority of messages to known recipients; 

27 g) determining a ratio reflecting a first number of wanted 

2 8 messages sent by the actual sender compared to a second number of 

29 unwanted or total messages sent by the actual sender; 
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h) determining a difference between a first number of 
expected messages sent by the actual sender and a second number of 
unexpected messages sent by the actual sender; 

i) determining a difference between a first number of 
times a user whitelisted a message from the actual sender and a second 
number of times a user blacklisted a message from the actual sender; 

j) determining a difference reflecting whether the actual 
sender sends a majority of messages to recipients who know the actual 
sender; and 

k) converting any of the above ratios or differences to a 
score indicating the likelihood the message is unsolicited e-mail. 
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1 205. (Original) The method of claim 181 wherein compiling statistics 

2 includes at least one of the following; 

3 a) determining a ratio of a first number e-mail messages 

4 sent by any sender using a final IP address to recipients in the network 

5 who have included the sender on the whitelist in a predetermined time 

6 period divided by a second number of e-mail messages sent by an any 

7 sender using the final IP address to users in the network in the 

8 predetermined time period; 

9 b) determining a ratio of a first number of recipients in 

10 the network who have included the sender on the whitelist divided by a 

11 second number of unique recipients in the network who received e-mails 

12 from any sender using the final IP address in a predetermined time 

13 period; 

14 c) determining a ratio of a first number of times in a 

15 predetermined time interval a message from any sender using the final IP 

16 address was moved from a whitelist to a blacklist divided by a second 

17 number of times a message from any sender using the final IP address 
is was moved from a whitelist to a blacklist; 

19 d) determining a ratio of a first number of times in a 

20 predetermined time interval a message from any sender using the final IP 

21 address was moved from a blacklist to a whitelist divided by a second 

22 number of times a message from any sender using the final IP address 
2 3 was moved from a blacklist to a whitelist; 

24 e) determining a ratio of a first number of unique users 

2 5 within a network who whitelisted any sender using the final IP address 

26 within a predetermined time period compared to a second number of 

2 7 unique users within the network who blacklisted any sender using the 

2 8 final IP address within the predetermined time period; 

29 f) determining a ratio reflecting whether any sender 

30 using the final IP address sends a majority of messages to recipients who 

31 have included the sender on the whitelist; 
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32 g) determining a ratio reflecting a first number of wanted 

33 messages sent by any sender using the final IP address compared to a 

34 second number of unwanted or total messages sent by any sender using 

35 the final IP address; 

3 6 h) determining a difference between a first number of 

37 expected messages sent by any sender using the final IP address and a 

3 8 second number of unexpected messages sent by any sender using the final 

39 IP address; 

40 i) determining a difference between a first number of 

41 times a user whitelisted a message from any sender using the final IP 

42 address and a second number of times a user blacklisted a message from 

43 any sender using the final IP address; 

44 j) determining a difference reflecting whether any sender 

45 using the final IP address sends a majority of messages to recipients who 

4 6 have included the sender on the whitelist; and 

4 7 k) converting any of the above ratios or differences to a 

4 8 score indicating the likelihood the message is unsolicited e-mail. 
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1 206. (Original) The method of claim 181 wherein compiling statistics 

2 includes at least one of the following: 

3 a) determining a ratio of a first number 

4 e-mail messages sent by any sender using a final domain name to 

5 recipients in the network who have included the sender on the whitelist in 

6 a predetermined time period divided by a second number of e-mail 

7 messages sent by an any sender using the final domain name to users in 

8 the network in the predetermined time period; 

9 b) determining a ratio of a first number of recipients in 

10 the network who have included the sender on the whitelist divided by a 

11 second number of unique recipients in the network who received e-mails 

12 from any sender using the final domain name in a predetermined time 

13 period; 

14 c) determining a ratio of a first number of times in a 

15 predetermined time interval a message from any sender using the final 

16 domain name was moved from a whitelist to a blacklist divided by a 

17 second number of times a message from any sender using the final domain 

18 name was moved from a whitelist to a blacklist; 

19 d) determining a ratio of a first number of times in a 

20 predetermined time interval a message from any sender using the final 

21 domain name was moved from a blacklist to a whitelist divided by a 

22 second number of times a message from any sender using the final domain 

23 name was moved from a blacklist to a whitelist; 

24 e) determining a ratio of a first number of unique users 

2 5 within a network who white listed any sender using the final domain name 

26 within a predetermined time period compared to a second number of 

2 7 unique users within the network who blacklisted any sender using the 

2 8 final domain name within the predetermined time period; 

2 9 f) determining a ratio reflecting whether any sender 

30 using the final domain name sends a majority of messages to recipients 

31 who have included the sender on the whitelist; 
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32 g) determining a ratio reflecting a first number of wanted 

33 messages sent by any sender using the final domain name compared to a 

34 second number of unwanted or total messages sent by any sender using 

35 the final domain name; 

3 6 h) determining a difference between a first number of 

3 7 expected messages sent by any sender using the final domain name and a 

3 8 second number of unexpected messages sent by any sender using the final 

3 9 dom ain name ; 

40 i) determining a difference between a first number of 

41 times a user white listed a message from any sender using the final 

4 2 domain name and a second number of times a user blacklisted a message 

43 from any sender using the final domain name; 

44 j) determining a difference reflecting whether any sender 

45 using the final domain name sends a majority of messages to recipients 
4 6 who have included the sender on the whitelist; and 

47 k) converting any of the above ratios or differences to a 

4 8 score indicating the likelihood the message is unsolicited e-mail. 
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1 207. (Original) The method of claim 181 wherein compiling statistics 

2 includes at least one of the following: 

3 a) determining a ratio of a first number 

4 e-mail messages sent by any sender using an IP path to recipients in the 

5 network who have included the sender on the whitelist in a predetermined 

6 time period divided by a second number of e-mail messages sent by an any 

7 sender using the IP path to users in the network in the predetermined 

8 time period; 

9 b) determining a ratio of a first number of recipients in 
10 the network who have included the sender on the whitelist divided by a 
n second number of unique recipients in the network who received e-mails 

12 from any sender using the IP path in a predetermined time period; 

13 c) determining a ratio of a first number of times in a 

14 predetermined time interval a message from any sender using the IP path 

15 was moved from a whitelist to a blacklist divided by a second number of 

16 times a message from any sender using the IP path was moved from a 

17 whitelist to a blacklist; 

18 d) determining a ratio of a first number of times in a 

19 predetermined time interval a message from any sender using the IP path 

20 was moved from a blacklist to a whitelist divided by a second number of 

21 times a message from any sender using the IP path was moved from a 

22 blacklist to a whitelist; 

2 3 e) determining a ratio of a first number of unique users 

2 4 within the network who white listed any sender using the IP path within a 

25 predetermined time 

26 period compared to a second number of unique users within the network 

27 who blacklisted any sender using the IP path within the predetermined 
2 8 time period; 

29 f) determining a ratio reflecting whether any sender 

30 using the IP path sends a majority of messages to recipients who have 

31 included the sender on the whitelist; 
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32 g) determining a ratio reflecting a first number of wanted 

33 messages sent by any sender using the IP path compared to a second 

34 number of unwanted or total messages sent by any sender using the IP 

35 path; 

36 h) determining a difference between a first number of 

37 expected messages sent by any sender using the IP path and a second 
3 8 number of unexpected messages sent by any sender using the IP path; 

3 9 i) determining a difference between a first number of 

4 0 times a user whitelisted a message from any sender using the IP path and 

41 a second number of times a user blacklisted a message from any sender 

42 using the IP path; 

4 3 j) determining a difference reflecting whether any sender 

44 using the IP path sends a majority of messages to recipients who have 

45 included the sender on the white list; and 

4 6 k) converting any of the above ratios or differences to a 

47 score indicating the likelihood the message is unsolicited e-mail. 

1 208. (Original) The method of claim 181 further comprising setting a 

2 predetermined threshold for accepting messages based on statistics 

3 associated with one of the following: 

4 a) an actual sender; 

5 b) a final IP address; 

6 c) a final domain name; 

7 d) an IP path. 

1 209. (Original) The method of claim 208 further comprising accepting 

2 messages when information about the message exceeds the predetermined 

3 threshold. 
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210. (Original) The method of claim 209 further comprising setting a low- 
threshold to differentiate wanted messages from unsolicited messages, 
wherein the low threshold is either: 

a) greater than one percent of a number of messages sent 
are accepted, wherein the messages are characterized by one of the 
following: 

i) an actual sender; 

ii) a final IP address; 

iii) a final domain name; or 

iv) an IP path; 

b) greater than one percent of a number of unique users 
accepting a message wherein the message is characterized by one of the 
following: 

i) an actual sender; 

ii) a final IP address; 

iii) a final domain name; or 

iv) an IP path. 

211. (Original) The method of claim 181 further comprising revising 
statistics when a recipient changes a whitelist/blacklist status of one of 
the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; 

d) an IP path. 

212. (Original) The method of claim 196 further comprising creating a 
key for storing information about the actual sender. 

213. (Original) The method of claim 212 wherein the key is the 
information used to identify the actual sender. 
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214. (Original) The method of claim 211 wherein a manual reversal of a 
white list/blacklist status is more heavily weighted when computing 
statistics. 



215. (Original) The method of claim 181 wherein processing the received 
message includes placing the message in the recipient's inbox. 

216. (Original) The method of claim 181 wherein processing the received 
message includes placing the message in a spam folder. 

217. (Original) The method of claim 216 further comprising monitoring 
the spam folder at predetermined intervals to determine whether 
messages should be released. 

218. (Original) The method of claim 217 further comprising 
automatically releasing the message from the spam folder when the 
reputation of one of the following: 



d) the IP path; 
passes a predetermined threshold. 

219. (Original) The method of claim 216 further comprising reevaluating 
the spam folder immediately before it is displayed to a recipient such that 
information about messages in the spam folder is current when viewed by 
the recipient. 

220. (Original) The method of claim 216 further comprising manually 
transferring the message from the spam folder to the recipient's inbox. 



a) 
b) 
c) 



the actual sender; 

the final IP address; 

the final domain name; or 
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1 221. (Original) The method of claim 208 further comprising each user 

2 setting a predetermined personalized spam threshold, wherein an 

3 incoming message that exceeds the spam threshold is sent to a folder 

4 designated to hold spam messages. 

1 222. (Original) The method of claim 208 further comprising each user 

2 setting a predetermined personalized delete threshold, wherein an 

3 incoming message that exceeds the delete threshold is deleted. 

1 223. (Original) The method of claim 181 further comprising maintaining 

2 at either the central database or the at least two centrally-maintained 

3 databases at least four of the following values: 

4 a) a number of messages which were explicitly ranked 

5 good; 

6 b) a number of messages which were implicitly ranked 

7 good; 

8 c) a number of messages whose ranking is unknown; 

9 d) a number of messages which were explicitly ranked 
10 bad; and 

n e) a number of messages which were implicitly ranked 

12 bad; 

13 wherein the values are based on messages having the same 

14 information about the sender including one of the following: 
is i) an actual sender; 

is ii) a final IP address used by the sender; 

17 iii) a final domain name used by the sender; or 

18 iv) an IP path used by the sender. 
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224. (Original) The method of claim 223 wherein the values represent 
one of the following: 

a) message counts; or 

b) ratings of unique users within the network. 

225. (Original) The method of claim 224 further comprising at least four 
of the values being returned to the recipient to allow the recipient to apply 
different weights to a message in order to categorize the message. 

226. (Original) The method of claim 181 further comprising evaluating 
an unknown sender based on statistics of one of the following: 

a) a known final IP address used by the sender; or 

b) a known final domain name used by the sender. 

227. (Original) The method of claim 181 further comprising evaluating 
an unknown sender using either a known final IP address or a known 
final domain name based on statistics about other new senders using 
either the known final IP address or the known final domain. 

228. (Original) The method of claim 181 further comprising giving an 
unknown final IP address or final domain name an initial good rating. 

229. (Original) The method of claim 181 further comprising giving an 
unknown final IP address or domain name an initial rating based on the 
length of time the network has been in operation. 

230. (Original) The method of claim 196 further comprising older 
members of the network overwriting a new member's message ratings 
when the new member's ratings are inconsistent when compared to other 
member's ratings. 
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231. (Original) The method of claim 184 wherein a final message score is 
determined by one of the following: 

a) an average of two scores for a message; or 

b) a product of two scores for the message; 

wherein the scores for messages are based on statistics associated with a 
least two of the following: 

i) an actual sender of the message; 

ii) a final IP address used by the sender; 

iii) a final domain name used by the sender; or 

iv) an IP path used by the sender. 

232. (Original) The method of claim 198 wherein personal statistics are 
checked at the local database before global statistics at either the central 
database or the at least two centrally-maintained databases are checked. 

233. (Original) The method of claim 196 further comprising rating a 
sender by: 

a) releasing small numbers a sender's messages to 
recipients; and 

b) monitoring the recipients' classification of these 

messages. 

234. (Original) The method of claim 196 further comprising changing one 
user's rating when other members outvote the user's rating. 

235. (Original) The method of claim 198 wherein either the central 
database or the at least two centrally-maintained databases return more 
than one value to the recipient. 
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236. (Original) The method of claim 215 further comprising monitoring 
the inbox at predetermined intervals to determine whether messages 
should remain in the inbox. 

237. (Original) The method of claim 184 wherein a first score for an 
unknown sender using a known final IP address or final domain name 
may be obtained by multiplying a second score for the final IP address or 
final domain name by a number less than one. 

238. (Original) The method of claim 192 further comprising creating the 
whitelist by adding the following to the whitelist: 

a) any e-mail addresses stored by a user of the e-mail 

program; 

b) any e-mail address in an outgoing message; and 

c) any e-mail address of a sender of a message having the 
same subject line as another message previously sent by the user. 

239. (Original) The method of claim 238 further comprising combining 
each e-mail address added to the whitelist with at least one other piece of 
information from the message header including: 



a) 


a display name used by the sender; 


b) 


a domain name used by the sender; 


c) 


the final IP address used by the sender; 


d) 


the final domain name used by the sender; 


e) 


the name of client software used by the actual sender; 


f) 


user-agent; 


g) 


timezone; 


h) 


source IP address; 


i) 


sendmail version used by a first receiver; and 


j) 


the IP path used to route the message. 
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240. (Original) The method of claim 238 further comprising: 

a) scanning messages received by the user; and 

b) determining if a sender of a received message is on the 
whitelist, wherein if the sender is on the whitelist: 

i) identifying information about the sender of the 
message based on data in the message, the identified information about 
the sender including at least one of the following: 

A) an actual sender of the message; 

B) a final IP address used by the sender; 

C) a final domain name used by the sender; 



or 



D) an IP path used by the sender; and 
ii) sending the identified information to the at least 



one database. 



241. (Original) The method of claim 181 further comprising categorizing 
a received message that cannot be rated locally when user activity is 
observed. 



242. (Original) The method of claim 184 further comprising using a 
second formula to compute the score for the message when the message is 
reevaluated, wherein the second formula differs from a first formula used 
to compute the previous message score. 



243. (Original) The method of claim 181 further comprising sending 
recipients a notification when any sender's reputation changes. 



244. (Original) The method of claim 243 further comprising reviewing all 
messages received in a predetermined time period preceding receipt of the 
notification and updating the categorization of the message as necessary. 
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245. (New) The method of claim 20 wherein information about at least 
one of the following: 

a) the final IP address; 

b) the final domain name; and 

c) the IP path; 

is sent to the recipient when there is insufficient information about the 
actual sender. 
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